tachomate-privacy

TachoMate (store name "TachoMate — Tachograph Tracker"), for Android and iOS, published by Kirolabs.

Package / bundle identifier: io.kirolab.tachomate

Last updated: 27 September 2026

1. The short version

- There is no account. No login, no sign-up, no password. TachoMate has no server of its own and keeps no copy of your data.

- Your working-time data stays on your device. Activities, shifts, driver card and .DDD data, violations, earnings, expenses and receipt photos are stored inside the app on your phone. Kirolabs never receives them and cannot recover them.

- All compliance calculations run on the device, offline. No driving or rest data is sent anywhere to be checked.

- Your location is processed on the device for activity and border detection. It is sent only to OpenStreetMap map services, and only when you look at the map, search for a place or look for places near you (section 3.2). Kirolabs never receives it.

- Some services receive technical data. Google Firebase receives crash reports and, only if you agree, anonymous usage statistics; RevenueCat and Apple or Google handle purchases; map and fuel-price services receive the area you are looking at. Usage analytics is off unless you switch it on.

- Nothing leaves the app through export or sharing unless you do it. Data exports, PDF reports, the weekly recap card and routes handed to Google Maps or Waze only leave when you tap Share or Open, and only go where you choose.

2. What stays on the device

TachoMate helps professional drivers keep track of their driving and rest times under EU Regulation 561/2006 and the AETR agreement. The app stores the following in a local database inside its own private storage on your device:

- your activities (driving, other work, availability, breaks, rest), shifts and the audit trail of every edit;

- countries logged against activities, including automatically detected border crossings;

- data read from your driver card or imported from .DDD files: this can include your name, card number, card validity, vehicle registrations, odometer readings, places and times recorded by the tachograph;

- violations, plans and reminders the app calculates from that data;

- earnings settings and results, expenses and the receipt photos you take or pick;

- vehicle details you enter, including a VIN and the decoded vehicle description;

- your routes and stops, and cached map, parking, fuel-price and truck-ban data;

- a hashed value derived from each imported driver-card number, used on the device to apply the per-purchase card limit (the card number itself is also stored on the device as part of the imported card data);

- your settings.

Operating-system backup. If Android Backup or iCloud Backup is switched on for your device, the operating system may include the app's storage in its backup. That backup is governed by Google's or Apple's policies, not ours; Kirolabs has no access to it.

Files you export. The full-data JSON export, PDF reports (shift, trip, fuel, CMR) and the weekly recap image are created on the device. Once you share or save one, it is held wherever you sent it, under that service's terms.

3. What leaves the device, and who receives it

The app sends data to the services listed below. Each section says what is sent and what is never sent. Nothing else is sent anywhere.

3.1 Location

TachoMate asks for location permission to detect when you start or stop driving (GPS auto-detect), to detect border crossings and log the country, to show HGV speed-limit reminders for the country and road type, to show where you are on the map, and to find places near you.

- Where positions are processed. Activity detection, border detection and speed-limit reminders are calculated on the device. Positions are never sent to Kirolabs, and they are not included in analytics or crash reports. The only services that receive location are the OpenStreetMap map services described in section 3.2, and the national fuel-price services in section 3.3, when you use the map, search for a place or look for places near you.

- GPS auto-detect (background location). GPS auto-detect is off by default. When you switch it on, TachoMate monitors your location in the background, even when no activity is running, so it can notice when a drive starts. On Android this runs as a foreground service with a persistent notification for as long as auto-detect is on. On iOS the app uses significant-change location monitoring, and iOS shows its location indicator. You can switch it off at any time in Settings → GPS auto-detect.

- Border detection and speed-limit reminders use location only while an activity is running.

- The operating system's location service (Google's fused location provider on Android, Apple's Core Location on iOS) operates under Google's or Apple's own privacy policy.

You can turn location off at any time in your device settings. Manual logging, timers and compliance checks keep working without it.

3.2 Map services (OpenStreetMap: tiles, Overpass, Nominatim)

TachoMate uses three OpenStreetMap services. Each receives your device's IP address and a standard app identifier with every request.

- Map tiles (tile.openstreetmap.org). When a map is on screen, the app downloads map images for the area shown. The tiles requested reveal the approximate area you are looking at, which is usually around you.

- Overpass API (overpass-api.de). To show truck parking, fuel stations and places to eat, the app sends the boundaries of the map area being shown. This also reveals the approximate area you are looking at.

- Nominatim geocoding (nominatim.openstreetmap.org). When you search for a place in the Map, the Route Planner or Truck Bans, the app sends the text you typed, together with an area around your position or the map so that nearby results come first. When you use "near me", "add my location" or another lookup of where you are (for example to name your current place or country), the app sends your device's precise coordinates.

What these services never receive: your activities, driving and rest times, driver card or .DDD data, earnings or anything else you have stored. Map and place results are cached on the device to keep repeat requests low.

These services are run by the OpenStreetMap Foundation and other operators under their own privacy policies (see the OSMF privacy policy (https://osmfoundation.org/wiki/Privacy_Policy)).

3.3 Fuel prices (national open-data services)

Where a country publishes fuel prices as open data, the app requests prices for the area you are looking at from that country's service: Tankerkönig (Germany), the French government's open fuel-price data (data.economie.gouv.fr) and E-Control (Austria). The request contains the coordinates of that area and your IP address, and so reveals your approximate location. Nothing else is sent.

3.4 VIN decoder (NHTSA vPIC)

If you decode a vehicle identification number, the app sends only the VIN to the U.S. National Highway Traffic Safety Administration's public vPIC service, together with your IP address as with any internet request. The result is cached on the device. Nothing else is sent.

3.5 Route hand-off (Google Maps, Waze)

The route builder never sends your route anywhere on its own. When you tap to open a route in Google Maps or Waze, the stops are passed to that app on your device, which then processes them under Google's or Waze's privacy policy.

3.6 Firebase Analytics (Google)

Firebase Analytics shows us, in aggregate, how the app is used, so we can decide what to fix and improve.

It is off unless you switch it on. During onboarding the app asks whether you want to share anonymous usage statistics. Until you agree, analytics collection is disabled and nothing is sent to Firebase Analytics.

What it sends, if you agree: events that Firebase collects automatically, such as the app being opened, session starts and in-app purchases (product, price and currency as reported by the store), and one property saying whether you use Pro. Firebase also collects standard technical information: app version, operating system version, device model, language, a country or region derived from your IP address, session timings, and a resettable Firebase app instance ID generated for this installation. Advertising-ID collection is disabled in the app.

What it never sends: activities, driving or rest times, violations, positions, driver card or .DDD contents, card numbers, names, vehicle registrations, VINs, earnings, expenses, receipt photos or any text you typed. Kirolabs does not use analytics data for advertising and does not sell it.

How to change your mind: Settings → Usage analytics. Switching it off withdraws your consent and stops collection immediately.

3.7 Firebase Crashlytics (Google)

Crashlytics tells us when the app crashes, and where in the code, so we can fix it. A crash report contains the stack trace, app version, operating system version, device model, a few technical notes from the moments before the crash, and an installation identifier used to group repeat crashes.

What it never sends: your activities, driver card data, positions, names or files. A crash report records where the code failed, not what data you had.

Crash reporting has no switch in the app. It relies on our legitimate interest in finding and fixing crashes that could make the app show wrong times or lose data (see section 5).

3.8 Firebase Remote Config (Google)

Remote Config lets us update rule datasets (such as HGV speed limits and truck-ban calendars), adjust which features are free or Pro and how many imports the free tier includes, switch off a feature if a problem appears, and require an update if a build is found to put your data at risk. The app downloads this configuration and keeps the last copy so it works offline.

What it sends: a standard request with the app ID, app version, platform, language, country and a Firebase installation identifier.

What it never sends: anything you have stored. It only downloads configuration.

3.9 Purchases: RevenueCat, Apple App Store and Google Play

If you buy TachoMate Pro, Apple or Google processes the payment. RevenueCat (RevenueCat, Inc.) checks the purchase and keeps track of your Pro status.

RevenueCat receives: an anonymous app user ID generated for this installation, the purchase receipt or token from the store, the product ID, purchase and expiry dates, the platform, the store country and currency, and technical information such as app and operating system version and your IP address. The app contacts RevenueCat whenever it checks your Pro status, including for users who have never bought anything.

Kirolabs never sees your card number, name or billing address; Apple or Google keep those under their own privacy policies.

RevenueCat never receives your activities, driver card data, positions or anything else you enter in the app. See RevenueCat's privacy policy (https://www.revenuecat.com/privacy).

3.10 Support email

Our support address is labskiro@gmail.com. If you write to us, we keep what you choose to send, including your email address and any attachment such as an exported report, for as long as we need it to help you and keep a record of the issue. We do not use your address for marketing.

3.11 What the app does not do

- It does not create an account or ask for your email address.

- It does not show advertising.

- It does not upload your activities, driver card data, earnings or photos to Kirolabs or anyone else.

- It does not sell data.

4. Children

TachoMate is a professional tool for drivers of goods and passenger vehicles. It is not directed at children under 13, or under 16 in the European Economic Area, and we do not knowingly collect data from them.

5. Your rights

Under the GDPR and similar laws you have the right to access, correct, erase and port your personal data, and to object to or restrict its processing.

- Access and portability. Your data is on your device. You can view it in the app and export all of it as a JSON file at any time, for free (Settings → Export all data).

- Correction. Edit any activity in the app; the audit trail keeps a record of the change.

- Erasure. Delete individual records in the app, or uninstall the app to delete everything it stored. Because Kirolabs holds no copy, there is nothing further for us to delete.

- Objection and withdrawal. Switch off Settings → Usage analytics and Settings → GPS auto-detect, and location in your device settings. You can object to crash reporting by writing to us.

- Legal basis. Analytics is based on your consent, given in onboarding or in Settings, and it stays off until you give it. You can withdraw it at any time with the Settings switch. Map and place lookups are necessary to provide the features you use. Crash reporting and Remote Config rely on our legitimate interest in keeping the app working and safe. Purchase processing is necessary to perform the contract you enter into when buying Pro.

For data held by Google, RevenueCat, Apple or map and fuel-price services, you can also contact them directly. You have the right to complain to a data protection supervisory authority.

6. Retention

- Data on your device: kept until you delete it or uninstall the app.

- Firebase Analytics: event data is kept for 14 months, then deleted by Google.

- Crashlytics: crash reports are kept for 90 days.

- RevenueCat: purchase records are kept for as long as needed to provide your Pro status and meet accounting obligations.

- Support emails: kept for as long as needed to handle your request.

7. Security

Your data lives inside the app's private storage, protected by the operating system's app sandbox and your device's lock screen and encryption. Connections to the services above use HTTPS. And because no server of ours holds a copy of your working-time data, there is no central store of it to breach.

8. Changes to this policy

If we change this policy, we will update the date at the top and, for significant changes, tell you in the app. We will never start sending your activities, driver card data or tachograph files off the device, or send your location to any new service, without a new, explicit choice by you.

9. Contact

Support email: labskiro@gmail.com

Support: https://kirolabs.io/contact